From 870f26829ed7af6b6995adc436fed883d1bc3460 Mon Sep 17 00:00:00 2001
From: Thomas Widhalm <thomas.widhalm@netways.de>
Date: Wed, 17 Jan 2024 11:58:47 +0000
Subject: [PATCH] Fix extra fields for Beats (#297)

fixes #296

---------

Co-authored-by: Tobias Bauriedel <tobias.bauriedel@netways.de>
---
 molecule/beats_peculiar/converge.yml     | 3 +++
 molecule/beats_peculiar/verify.yml       | 8 ++++++++
 molecule/elasticstack_default/verify.yml | 1 +
 roles/beats/templates/filebeat.yml.j2    | 2 +-
 4 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/molecule/beats_peculiar/converge.yml b/molecule/beats_peculiar/converge.yml
index 95a68e27..e5a46244 100644
--- a/molecule/beats_peculiar/converge.yml
+++ b/molecule/beats_peculiar/converge.yml
@@ -18,6 +18,9 @@
           pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^Caused by:'
           negate: false
           match: after
+        fields:
+          testfield: thisisatest
+          testfield2: thisisanothertest
     elasticsearch_jna_workaround: true
     elasticsearch_disable_systemcallfilterchecks: true
     elasticstack_full_stack: false
diff --git a/molecule/beats_peculiar/verify.yml b/molecule/beats_peculiar/verify.yml
index 4d089a38..c7aa9fd5 100644
--- a/molecule/beats_peculiar/verify.yml
+++ b/molecule/beats_peculiar/verify.yml
@@ -26,3 +26,11 @@
       when:
         - beats_filebeat_version.stdout.find('8.4.1') == -1
         - elasticstack_release == 8
+
+    - name: Ensure field is set correctly
+      ansible.builtin.lineinfile:
+        dest: /etc/filebeat/filebeat.yml
+        line: "    testfield: thisisatest"
+      check_mode: true
+      register: _field
+      failed_when: _field.changed
diff --git a/molecule/elasticstack_default/verify.yml b/molecule/elasticstack_default/verify.yml
index 3a2e8430..110673d4 100644
--- a/molecule/elasticstack_default/verify.yml
+++ b/molecule/elasticstack_default/verify.yml
@@ -135,3 +135,4 @@
         success_msg: "'{{ item }}' was found in nodes.content"
       with_inventory_hostnames: all
       when: groups['elasticsearch'] | length > 1
+
diff --git a/roles/beats/templates/filebeat.yml.j2 b/roles/beats/templates/filebeat.yml.j2
index 43456cde..96bfebbe 100644
--- a/roles/beats/templates/filebeat.yml.j2
+++ b/roles/beats/templates/filebeat.yml.j2
@@ -17,7 +17,7 @@ filebeat.inputs:
 {% endif %}
 {% if beats_filebeat_log_inputs[input].fields is defined %}
 {% for field in beats_filebeat_log_inputs[input].fields %}
-    {{ field }}
+    {{ field }}: {{ beats_filebeat_log_inputs[input].fields[field] }}
 {% endfor %}
 {% endif %}
 {% endif %}